Module 4 of StartCloud's Cyber Hygiene for Staff learning pathway, in five short units with a knowledge check: locking your screen before you walk away, why updates close holes criminals already know about, honest modern advice on public Wi-Fi and hotspots, and house rules for mystery USBs, free downloads and personal devices.
Safe Habits for Devices, Wi-Fi and Working Anywhere
Lock it before you walk
An unlocked screen is an open filing cabinet. Anyone walking past can read what is on it, and anyone with thirty seconds and a bit of nerve can send an email as you, copy a file, or just quietly take photos of a client list. None of that requires hacking skills. It requires you to be at the sandwich shop.
The fix is one small habit: lock the screen before you walk away. Every time, everywhere, even at home. It takes half a second and it turns your device from an open filing cabinet into a locked one.
Windows key + L
Two keys, held for half a second, and your screen is locked. It costs nothing, nobody sees your email while you refill your coffee, and everything is exactly where you left it when you sign back in. Do it every time you stand up, even for a minute, until your hand does it without asking your brain first.
- Works everywhere: office, home, client site, cafe
- Nothing closes, nothing is lost, you just sign back in
- Set the screen to auto-lock after a few minutes as a backstop
Control + Command + Q
The Mac version of the same reflex. Three keys and the lock screen appears instantly. If you use a MacBook with Touch ID, unlocking again takes about as long as sitting back down, so there is really no excuse to skip it.
- Locks instantly without logging you out
- Touch ID or your password gets you straight back in
- Hot corners can lock the screen with a flick of the mouse too
Yes, these count too
Your phone probably has your work email, Teams, and a saved password or fifty. A short auto-lock (under a minute) plus face or fingerprint unlock means it protects itself the moment you put it down. If your work phone currently sits unlocked on cafe tables, this is your unit.
- Auto-lock set to a minute or less
- Face or fingerprint unlock so short lock times never annoy you
- A proper PIN underneath, not 0000 or your birth year
Working from a cafe, an airport lounge, or seat 23B on the red-eye to Melbourne? The person beside you can read your screen as easily as you can. Most will not care. The one who does only needs a glance at a payroll spreadsheet or a client email. Angle your screen away from strangers, drop the font size a notch for sensitive work, and save the truly confidential stuff for somewhere with fewer elbows.
A laptop bag on the back seat is one smashed window away from being someone else's laptop, and that is a genuinely common way work devices go missing in Perth. Not master hackers. A brick and eight seconds. Take the bag with you, or lock it in the boot before you drive off, not once you have parked with an audience.
Here is the bit nobody explains when the restart nag appears at the worst possible moment: most updates are not new features. They are patches for security holes criminals already know about. The moment a fix is published, the hole it fixes becomes public knowledge, and attackers start scanning for machines that have not applied it yet.
Which means an update is less like repainting the office and more like fixing a broken lock the whole neighbourhood has been told about. The boring machines that patch quickly are the safe ones. Boring is the goal here.
Microsoft, Apple or an app maker fixes a security hole and releases the update. The fix itself quietly documents exactly where the hole was.
Attack tools built from fresh patches appear within days, sometimes hours. The gap between a fix shipping and attacks starting is short and getting shorter.
The attacks land almost entirely on devices still running the old version. The whole game is not being one of them, and the entry fee is a restart.
- Restart when the machine asks, ideally the same day
- Turn on automatic updates for Windows or macOS, your phone, and your browser
- Same again on any personal device you use for anything work-adjacent
- If an update looks odd or arrives by email or pop-up from a website, ask IT before touching it
Nobody expects you to drop a client call because Windows feels needy. Finish what you are doing, then restart at the next natural break, lunch, or end of day. The only losing move is the snooze button on repeat. If you are still clicking "remind me later" in week three, the criminals scanning for your exact unpatched version are more organised about your laptop than you are.
Time for some honesty, because Wi-Fi advice has a scaremongering problem. The old horror stories about public Wi-Fi came from an era when most websites sent everything unencrypted, so anyone on the same network could read it. That era is mostly over. Nearly everything you use now runs over HTTPS, which encrypts your traffic even on a dodgy network.
So the cafe Wi-Fi is less scary than the headlines said. Less scary is not the same as safe, though, because the interesting attacks moved. The modern trick is not eavesdropping on a real network, it is being the network: a fake hotspot with a perfectly plausible name, waiting for people in a hurry.
- Traffic to proper websites (the padlock, https) is encrypted in transit
- Someone on the same cafe Wi-Fi cannot simply read your banking or email
- Most apps and cloud services you use for work encrypt their connections too
- The old "never do anything on public Wi-Fi" headlines are largely out of date
- A fake hotspot with a convincing name, run by someone who controls everything you see
- Lookalike sign-in pages served up by that hotspot to harvest your password
- You cannot tell a genuine network from an evil one by the name or the signal bars
- Your home router still running admin/admin since the day it came out of the box
Your phone's hotspot. For anything sensitive (banking, payroll, client files), your own hotspot is the connection you control end to end. Mobile data in Australia is decent almost everywhere you would open a laptop.
The company VPN, if you have one. If your business gives you a VPN, use it whenever you are on a network you do not control. It wraps everything you do in another layer of encryption, whoever owns the Wi-Fi.
Known networks, verified. Hotel or venue Wi-Fi is fine for ordinary browsing. Check the exact network name on signage or with staff before connecting, because anyone can broadcast a network called anything.
Random free Wi-Fi, last and lightly. An unverified free network is fine for reading the news. It is not the place to type passwords or open the company finances, and it never needs your credit card details to connect.
If you work from home, your router is part of your office now. Two jobs, ten minutes, once: change the admin password from whatever it shipped with, and turn on automatic firmware updates if it has them (or check for updates a couple of times a year if it does not). A router still on its factory password is the home-office version of leaving the key under the mat, and the mat is labelled.
This last unit is a short parade of things that look harmless and are not. None of them require you to memorise anything technical. Each one just needs a house rule, and the house rules are refreshingly blunt.
The mystery USB stick
A USB stick found in the car park, the meeting room, or your letterbox is not free storage. Dropping infected drives where curious people will find them is a genuine attack technique, and it works because plugging one in feels harmless. The stick can install malware the moment it connects, no double-click required.
- Found a USB stick? Hand it to IT, or bin it
- Never plug unknown drives into a work or home computer
- The same goes for free promotional USBs from events, sorry
Free downloads and browser extensions
A free PDF converter, a coupon extension, a "driver updater" from page one of a search. Wrapping malware inside free software is one of the oldest tricks going, and search ads have made it worse: the poisoned copy often sits above the real one. If the business needs a tool, that is a request to IT, not a download button.
- Stick to the apps your business has approved
- Treat browser extensions as software, because they are
- Need something new? Ask IT, it is genuinely a two-minute conversation
Personal devices and work
Keep work in work accounts and on work devices where you can. Work files in a personal Dropbox or emails forwarded to a personal inbox lose every protection the business has set up, and nobody can help you when something goes wrong there. If you genuinely need to use a personal device for work, it plays by work rules.
- Work files live in work systems, not personal cloud accounts
- On a personal device: same lock, update and MFA habits as your work one
- Lost a device with work access on it? Tell IT straight away, no embarrassment required
Notice that nothing in this module needed a technical bone in your body. Lock the screen, restart when asked, prefer your own hotspot, and do not plug in things you found on the ground. Small habits, done every time, are worth more than any amount of expensive software sitting on top of careless ones.
- Australian Cyber Security Centre: How to secure your devices
- Australian Cyber Security Centre: How to update your device and software
- Australian Cyber Security Centre: Connecting to public Wi-Fi and hotspots
- Australian Cyber Security Centre: Secure your Wi-Fi and router
- Australian Cyber Security Centre: Security tips for remote working
Guidance was current at the time of writing (July 2026). The ACSC updates its advice regularly, so the links above are always the freshest word on the subject.
Knowledge check
5 quick questions. Get 4 right and the module is yours.
1. You are working from a busy cafe and need to duck to the counter for two minutes. What happens to your laptop?
2. Why do software updates matter so much for security?
3. You are at the airport and spot a free network called "Perth_Airport_FREE_2". You need to send an invoice before boarding. Best move?
4. There is a USB stick sitting in the office car park. What is the move?
5. You work from home a couple of days a week. What actually matters about your home router?